topic XML Data Line Breaking on DateTime tag in Getting Data In

XML Data Line Breaking on DateTime tag

ekenne06 — Thu, 28 Jan 2021 17:33:30 GMT

Here is my data normally.

2021-01-26 00:00:44.2885 [INFO] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA: <?xml version="1.0" encoding="utf-8"?> <DCNSMessage> <ID>SIXPAC</ID> <RType>14</RType> <DateTime>2021-01-26T00:00:35Z</DateTime> <ActiveLink> <StartDateTime>2021-01-25T23:50:00Z</StartDateTime> <StopDateTime>2021-01-26T00:00:00Z</StopDateTime> <LocationActive> <Location>S-SLC01</Location> <Active>0</Active> </LocationActive> </ActiveLink> </DCNSMessage>

for some reason when the data gets indexed, it's line breaking, so I only get the following data:

Any idea on why it's breaking at the DateTime tag?

Re: XML Data Line Breaking on DateTime tag

scelikok — Thu, 28 Jan 2021 18:59:07 GMT

Hi @ekenne06,

Splunk breaks events when it finds a timestamp by default. You should set timestamp like below;

[your_sourcetype] TIME_PREFIX = ^ TIMEFORMAT = %Y-%m-%d %H:%M:%S.%4Q

Re: XML Data Line Breaking on DateTime tag

ekenne06 — Thu, 28 Jan 2021 20:36:46 GMT

so I tried that and it's still breaking at that spot. I did a btool props --debug . Will update if I find anything there. Currently messing around with a few props.conf settings